peergos-making-yourself-audit-ready-with-verae-datacubes/source/executive.rst

Executive summary
=================

Software alone does not make an organization HIPAA certified, SOC 2
attested, or ISO 27001 certified.

That sentence is the point of this document. It is also the sentence
that is most often skipped when a vendor, an integrator, or an internal
champion shows encryption, hashing, or a pentest PDF and treats the
conversation as finished. It is not finished. Encryption is a control.
A pentest is an evaluation of a component. A certificate, an attestation,
or a covered-entity determination is a statement about **an organization**
--- its legal entity, its people, its written policies, its operating
procedures, its internal controls, the evidence those controls produce,
and the independent party that examined that evidence.

The Verae DataCube Solution gives an organization tools to **store**,
**communicate**, **timestamp**, **verify**, and **audit** for compliance.
Those tools are real, they are specific, and they are described in the
chapters that follow. They are still only tools. To obtain HIPAA-aligned
status as a covered entity or business associate with a defensible
program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
the organization must still:

* write and live by **policies** (what the organization says it will do);
* operate **procedures** (how staff actually do it, every day);
* design and test **internal controls** (the checks that catch failure);
* retain **evidence** (logs, tickets, screenshots, signed approvals,
  restore tests, training records);
* engage an **independent auditor**, CPA firm, or ISO registrar, as the
  chosen program requires.

Verae cannot issue those certificates. Verae cannot sit in the
organization's chair during an OCR investigation, a SOC 2 fieldwork
week, or an ISO Stage 2 audit. What Verae can do --- and what this
briefing is written to make precise --- is provide the **tools**, the
**background**, and the **software infrastructure** that make it easier
to implement the **technical portion** of those programs.

What a Verae DataCube Server Solution does
------------------------------------------

A Verae DataCube Server Solution provides **secure communications and
storage** for two classical information-security states:

* **Data in transit** --- messages, objects, and control traffic while
  they move from one endpoint to another.
* **Data at rest** --- messages, objects, metadata, and receipts while
  they sit on disk, in a replica, or in an archive.

Those two states are not the same problem, and they are not solved by
the same mechanism. This document treats them separately on purpose.

Data in transit
---------------

Verae uses best-in-class encryption for messaging **from point to
point**. The content of a message is sealed so that only the intended
endpoints can open it. Routing, however, **must remain visible**: a
message that cannot be addressed cannot be delivered. Subjects,
destination handles, and size or timing metadata are therefore
visible to the transport. The transport is treated as
**honest-but-curious**. It can drop, delay, or copy ciphertext. It
cannot read the body if it does not hold endpoint private keys.

Data at rest
------------

Encryption at rest is performed through **IPFS content-addressed
blocks**. Each block is named by its hash. Peergos verifies those
hashes on read and on write. A restore is therefore
**tamper-evident**: if a block was altered, its hash no longer
matches, and the client refuses it. This is not a plaintext tape
backup. It is a re-fetch of hashed ciphertext plus a verification
that the bits are the bits that were stored.

Global timestamped receipts
---------------------------

Independently of who stores the bytes, Verae issues **global
timestamped receipts** based on **document hashes**. A receipt is
proof of the **time and sequence of the first registration** of a
block of digital information --- a message, an image, a document, or
any other digital object that can be stored in digital media. The
receipt does not require Verae to see the object. It requires a
fingerprint of the object, registered at a time that can later be
shown to third parties.

Peergos, evaluated in Europe
----------------------------

The offline storage and replication system used with Peergos was
**audited twice in Europe**, and the protocol was designed under
work that was independently reviewed:

* **2019 --- Cure53, Berlin, Germany.** Pentest, source-code audit,
  and **crypto/design review** (May--June 2019). No fundamental
  architectural or cryptographic problems. Issues found were fixed.
  Cure53 stated that the platform **passed this evaluation**.
* **2024 --- Radically Open Security B.V., Amsterdam, Netherlands.**
  Crystal-box pentest plus code audit of the Peergos web UI
  (September--November 2024). **Zero** findings rated extreme, high,
  or elevated; **two** moderate; **six** low. Peergos states all
  were fixed. No data exposure and no integrity compromise (the
  issues were mostly UI crashes).

Both firms are **EU-based**. Both full reports are **public**. That
is a **security evaluation of the Peergos protocol and
implementation**. It is **not** a HIPAA certificate, a SOC 2 report,
or an ISO 27001 certificate for Peergos, for Verae, or for any
customer.

Verae global timestamping
-------------------------

The Verae Global Timestamping and receipt solution is a
**cross-blockchain** design. It certifies the time and date stamp of
a digital object and stores that information in a **digital bundle**
that can carry private metadata, attached files, and an internal
blockchain. That organizational chain is **cross-verified** either:

* from an organizational server **linked to the central Verae
  server**, or
* by **directly syncing** with Verae's central timestamping server.

The result is **proof of existence** of a digital object at a
specific time and date. When the organization wants the object
itself stored --- not only its fingerprint --- the object can live
inside an **encrypted Peergos DataCube**.

Write-once Iceberg archive
--------------------------

Those DataCubes are archived into a **write-once external Iceberg
file-storage solution** for compliance reasons. The archive is
designed to sit **outside the deletion control of any single
party**. That is a retention and legal-hold property, not a
marketing slogan: once a cube is committed to the write-once tier,
neither the customer operator, nor Verae, nor a hosting vendor
should be able to quietly erase it.

What this briefing is, and is not
---------------------------------

This briefing describes the **technical portion** of a compliance
program that an organization can build with Verae DataCubes. It
indexes each of the points above as its own chapter, in enough
detail that a CISO, a CCO, outside counsel, or an auditor can
distinguish:

* what the software **does**;
* what the independent **Peergos evaluations** actually said;
* what **Verae timestamping** actually proves;
* what the organization **must still write, operate, and have
  examined**.

It does not claim that installing this software finishes HIPAA,
SOC 2, or ISO 27001. Anyone who says otherwise is not describing
this product honestly.